Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale is pretty useful

blog.6nok.org

Post reply on HN
Print view View original

101–110 of 419 posts

Re: Tailscale is pretty useful

#101

Post by stego-tech »

tjoff wrote: post #89
stego-tech wrote: post #49

Earlier quoted context omitted.

Call me Cappy Paranoid, but I fall into the camp of "You should never trust a service provider, ever ," and build infrastructure accordingly; I believe this falls into an extreme interpretation of "zero trust". So while also implementing Tailnet locks and other security measures to constrict traffic flow, I'd also consider going a step further by only permitting server or resource access based on client certificate v…

Then why go with tailscale in the first place? There is slacks nebula and other options that are completely self-hosted from the start. Feels like such a weird hype around tailscale.

I feel like a lot of hype around Tailscale is because it vastly simplifies VPNs and their associated networking, especially for businesses, startups, or homelabs where the focus might be elsewhere or specific talent is unavailable. The problem arises when folks don't quite understand why specific decisions are being made, or use the product in nonstandard (or even negative) ways. I've seen stories of folks deploying Tailscale on every machine in their LAN, thinking that secures their traffic; using it to cross boundaries in the firewall or router between secure and insecure VLANs; and using it to connect to servers in lieu of a proper router or firewall with appropriate ACLs.

Tailscale is an excellent piece of software, provided it's implemented in a way to emphasize security, and not weaken it. In OPs case, being used as an accessibility aide to a system that couldn't be secured any other way while preserving external access (in their case due to CGNAT) was an excellent use of Tailscale.

Re: Tailscale is pretty useful

#102

Post by Duralias »

forty wrote: post #48

Does it have "entry nodes" ? For exemple if I wanted to receive emails on my server while my home connection does not have an open port 25.

They don't host anything like that, DERP servers are, aside from Funnel, internal to the tailscale network.

But you can proxy traffic using a VPS really easily, which is basically the reverse of exit nodes.

Re: Tailscale is pretty useful

#104

Post by codetrotter »

stego-tech wrote: post #49
iamdamian wrote: post #38

I'm curious to hear well-informed reasons from this crowd for why we can trust Tailscale given the non-self-hosted part of the architecture? Does it come down to Tailnet locks [1], not worrying that Tailscale will be compromised, not worrying that your home network is worth compromising, or something else? [1]: https://tailscale.com/kb/1226/tailnet-lock

Call me Cappy Paranoid, but I fall into the camp of "You should never trust a service provider, ever ," and build infrastructure accordingly; I believe this falls into an extreme interpretation of "zero trust". So while also implementing Tailnet locks and other security measures to constrict traffic flow, I'd also consider going a step further by only permitting server or resource access based on client certificate v…

> Is that a gigantic PITA to implement? Oh heck, you betcha it is

I use my own self-hosted Wireguard VPN server. I agree with a lot of what you were saying about client certificates etc. And I plan to eventually do that sort of thing on some of my services in my own Wireguard VPN too.

But in terms of Tailscale, if you are going to set up all kinds of client certificate things that will take a lot of time and effort, why not self-host Wireguard also?

Setting up a Wireguard server is super simple. The only couple of things that complicate it a tiny bit is opening up a port for it for inbound connections if you host it from your home connection rather than a rented server, and managing the Wireguard public keys that are allowed to connect.

But if you are going to do a whole client certificate setup on top anyway, the work of setting up your own Wireguard VPN is small in comparison.

Unless like OP your ISP has put CGNAT on you.

Re: Tailscale is pretty useful

#105

Post by frotaur »

yjftsjthsd-h wrote: post #67
smy20011 wrote: post #43

I use tailscale to build my personal podcast that include local weather and stocks I interested in. Running the whole pipeline on a steamdeck and use tailscale to securely delivery the generated podcast to my phone.

How are you going from weather and stock information to a podcast? Is there some sort of TTS step there?

See notebookLM, as an example

Re: Tailscale is pretty useful

#106

Post by 9dev »

We’re using Tailscale for our internal network, and it’s amazing. We’re a team distributed across multiple countries, and with Tailscale, it’s like we’re sitting in a single office, connected to the same router. And on top of that, we get centrally managed ACLs for everyone, TLS certificates, and SSO with Microsoft accounts. Amazing stuff!

My main gripe, though, is DNS. It’s great to be able to reach prod-db-1, prod-db-2, and prod-db-3, tag them as „db“ and create a rule to allow TCP on db:5432. however, it’s annoying that all of this is supported, but not the obvious extension - DNS records for the tags, so I can point apps to a group of servers belonging to the same tag.

Re: Tailscale is pretty useful

#107

Post by joshstrange »

jen729w wrote: post #22
ydnaclementine wrote: post #11

> it’s no longer possible thanks to a cursed thing called CGNAT as someone who does publicly expose services that have auth, why does CGNAT make exposing ports publicly bad?

FYI my ISP (Aussie Broadband) will put you on a non-CGNAT subnet if you call and ask. Tailscale is a better idea.

My ISP (USA, Metronet) will give you a static IP (instead of their CGNAT) for $10/mo which I happily pay.

Tailscale is great but direct is always better IMHO.

Re: Tailscale is pretty useful

#108

Post by MasterYoda »

Is there any simple FOSS alternative to tailscale that you can self-host?

The only thing I need is to simply connect to the home network and I dont want to need to open and forward ports etc in routers and firewalls for it to work, just something simple plug and play and is secure.

Re: Tailscale is pretty useful

#109

Post by throwawaymaths »

tjoff wrote: post #89
stego-tech wrote: post #49

Earlier quoted context omitted.

Call me Cappy Paranoid, but I fall into the camp of "You should never trust a service provider, ever ," and build infrastructure accordingly; I believe this falls into an extreme interpretation of "zero trust". So while also implementing Tailnet locks and other security measures to constrict traffic flow, I'd also consider going a step further by only permitting server or resource access based on client certificate v…

Then why go with tailscale in the first place? There is slacks nebula and other options that are completely self-hosted from the start. Feels like such a weird hype around tailscale.

have you ever managed a tailnet? it's so easy.

Re: Tailscale is pretty useful

#110

Post by cess11 »

9dev wrote: post #106

We’re using Tailscale for our internal network, and it’s amazing. We’re a team distributed across multiple countries, and with Tailscale, it’s like we’re sitting in a single office, connected to the same router. And on top of that, we get centrally managed ACLs for everyone, TLS certificates, and SSO with Microsoft accounts. Amazing stuff! My main gripe, though, is DNS. It’s great to be able to reach prod-db-1, prod-…

Similar to how you would use keepalived to get a virtual IP and broker between addresses under it?
Post reply on HN